SushiSwap’s Token Launchpad Hacked for Over $3M in Ethereum

Sep 17, 2021 | Decrypt News | 0 comments

sushiswap’s-token-launchpad-hacked-for-over-$3m-in-ethereum

SushiSwap’s token platform called MISO was reportedly attacked on Thursday, with the hacker stealing 864.8 Ethereum, approximately $3 million in current prices.

SushiSwap is one of the largest decentralized exchanges (DEX) in the world and rival to Uniswap, with more than $495 million in trading volume over the last 24 hours, per CoinGecko.

As described on the project’s website, MISO is “a suite of open-source smart contracts created to ease the process of launching a new project on the SushiSwap exchange.”

According to SushiSwap’s CTO Joseph Delong, MISO fell victim to a so-called supply chain attack, which saw an anonymous contractor going under the GitHub handle AristoK3 inject malicious code into the platform’s front end and replace the auction’s wallet with their own address.

The exploited NFT auction in question is automobile-themed Jay Pegs Auto Mart, which has already been patched.

According to Ethereum blockchain explorer Etherscan, which has identified the address shared by Delong as the one involved in the MISO exploit, the attack occurred at 12:04 pm Eastern time on Thursday.

This is not the first time MISO has encountered a similar problem. On a previous occasion, however, the platform’s team got away lightly.

Last month, samczsun, a security researcher for venture capital firm Paradigm, discovered a vulnerability while examining the smart contract code of the BitDAO token sale on the MISO platform.

The researcher said that the vulnerability could have potentially resulted in a loss of about $350 million.

Ethereum DEX Avoids $350M DeFi Hack Thanks to White Hat Heroics: Report

The sale concluded without any incident, raising $365 million in the process. However, it required the BitDAO team to manually end the token auction to neutralize the potential threat.

Hacker’s identity known?

SushiSwap claims there are reasons to believe that the hacker is a Twitter user @eratos1122, who “has done work with Yearn.Finance and approached many other projects.”

However, the Twitter profile Delong linked to shows a different GitHub handle, not AristoK3 as SushiSwap claims.

Delong added that SushiSwap asked crypto exchanges FTX and Binance to share the attacker’s hacker’s know-your-customer (KYC) information, “but they have resisted on this time-sensitive matter.”

“I recommend that you test your own user interface in order to identify exploits early on,” said Delong.

He also stated that SushiSwap instructed the company’s lawyer Stephen Palley to file a complaint with the FBI if the stolen funds are not returned by 8 am Eastern Time on Friday.

News Source from Decrypt.co

Related Articles

Baseball Legend Willie Mays Launches NFT Collection on Nifty Gateway

Just in time for the 117th World Series this month, the Costacos Collection announced today the upcoming release of a non-fungible token (NFT) line dedicated to Baseball Hall of Famer Willie Mays. Hosted on the NFT platform Nifty Gateway, the collection features...

Two US banks sign up for bitcoin trading platform from Q2 and NYDIG

New York’s Five Star Bank and California's UNIFY Financial Credit Union are the first U.S. institutions to offer bitcoin trading through a platform from Austin-based Q2 Holdings and New York Digital Investment Group (NYDIG).  Through the so-called Q2 Digital Banking...

Pin It on Pinterest

Share This